Bug 2464383 (CVE-2026-31748)

Summary: CVE-2026-31748 kernel: comedi: me_daq: Fix potential overrun of firmware buffer
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's comedi: me_daq module. The `me2600_xilinx_download()` function, responsible for loading firmware, does not adequately validate the length of the provided firmware data stream. This vulnerability allows for a buffer overrun, which can lead to memory corruption within the kernel. This could potentially cause system instability or other undefined behavior.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-05-01 15:03:38 UTC 
In the Linux kernel, the following vulnerability has been resolved:

comedi: me_daq: Fix potential overrun of firmware buffer

`me2600_xilinx_download()` loads the firmware that was requested by
`request_firmware()`.  It is possible for it to overrun the source
buffer because it blindly trusts the file format.  It reads a data
stream length from the first 4 bytes into variable `file_length` and
reads the data stream contents of length `file_length` from offset 16
onwards.  Although it checks that the supplied firmware is at least 16
bytes long, it does not check that it is long enough to contain the data
stream.

Add a test to ensure that the supplied firmware is long enough to
contain the header and the data stream.  On failure, log an error and
return `-EINVAL`.
Comment 1 Keith Grant 2026-05-01 21:59:00 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026050141-CVE-2026-31748-ab3e@gregkh/T